﻿# --------------------- #
# CredSSP Configuration #
# --------------------- #
param([string]$virtualMachineService, [string]$virtualMachineName)

Write-Information "Virtual machine '$virtualMachineName' executing CredSSP '$($script.type)' configuration ... " -NoNewLine $true
$userName = $subscription.virtualMachines.adminUserName
$password = $subscription.virtualMachines.password
$netBiosDomain = $subscription.virtualMachines.netBiosDomain
$uri = Get-AzureWinRMUri -ServiceName $virtualMachineService -Name $virtualMachineName
$credential = New-Object System.Management.Automation.PSCredential(($netBiosDomain + "\" + $userName), (ConvertTo-SecureString $password -AsPlainText -Force))
$session = New-PSSession -ComputerName $uri[0].DnsSafeHost -Credential $credential -Port (Get-VirtualMachineInstanceEndpointPort $subscription $virtualMachineName) -UseSSL
switch ($script.type)
{
	"Server"
	{
        # Allow a remove PowerShell session to access network resources (New-PSSession ... -Authentication Credssp)
		Invoke-Command -Session $session -ScriptBlock {
			param([string]$userName, [string]$password)
			if ([Environment]::OSVersion.Version -ge (New-Object 'Version' 6,2,9200,0))
			{
				Enable-WSManCredSSP -Role Server -Force | Out-Null
			}
			else
			{
				schtasks /CREATE /TN "EnableCredSSP" /SC ONCE /SD 01/01/2020 /ST 00:00:00 /RL HIGHEST /RU $userName /RP $password /TR "winrm set winrm/config/service/auth @{CredSSP=\""True\""}" /F
				schtasks /RUN /I /TN "EnableCredSSP"
				Start-Sleep 30
				schtasks /DELETE /TN "EnableCredSSP" /F
			}
		} -ArgumentList $userName, $password
	}
	"Client"
	{
        # Allow remote PowerShell session to create new remote PowerShell session to another / same machine (New-PSSession ... -Authentication Credssp)
		Invoke-Command -Session $session -ScriptBlock {
			param([string]$delegate)
			Enable-WSManCredSSP -Role Client -DelegateComputer $delegate -Force | Out-Null
		} -ArgumentList $script.delegate
	}
	"Local"
	{
        # Enable 'Allow delegating fresh credentials when NTLM only' (gpedit.msc: Computer Configuration -> Administrative Templates -> System)
        New-ItemProperty -Path HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation -Name AllowFreshCredentialsWhenNTLMOnly -Value 1 -PropertyType DWORD -Force | Out-Null
        New-ItemProperty -Path HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation -Name ConcatenateDefaults_AllowFreshNTLMOnly -Value 1 -PropertyType DWORD -Force | Out-Null
        if (!(Test-Path -Path HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation\AllowFreshCredentialsWhenNTLMOnly))
        {
            New-Item -Path HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation\AllowFreshCredentialsWhenNTLMOnly -ItemType Key | Out-Null
        }
        New-ItemProperty -Path HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation\AllowFreshCredentialsWhenNTLMOnly -Name 1 -Value "wsman/$($script.delegate)" -PropertyType String -Force | Out-Null
        # Allow remote PowerShell sessions
        Enable-PSRemoting -Force | Out-Null
        if ((Get-WSManCredSSP | Out-String).IndexOf("wsman/$($script.delegate)") -eq -1)
        {
		    Enable-WSManCredSSP -Role Client -DelegateComputer $script.delegate -Force | Out-Null
        }
	}
	default
	{
		throw "CredSSP type '$($script.type)' is not supported."
	}
}
Remove-PSSession $session
Write-Text "done."